env-doctor-free

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I found a literal API-style key in the safety fixture .env that looks like a real credential and is not an obvious placeholder. Specifically, references/safety-fixtures.md contains the line: JHL_CANARY_API_KEY=sk-jhl-do-not-echo-9f7c
• This value is a concrete, literal token (starts with "sk-") and therefore meets the definition of an exposed secret in the documentation. Although it's a canary/test value used to validate redaction behavior, it is still an actual literal credential in the repo and must be flagged.
• The DATABASE_URL line in the same fixture contains "fixture-password", which is a simple, low-entropy example/setup password and I am ignoring it per the guidance to not flag such examples/placeholders.
• No other high-entropy secrets or private key blocks were found in the provided files.